Review Beyond agile auditing

The IIA introduced the three lines model (1^st line: management team, 2^nd line: risk management/quality assurance/compliance, 3^rd line: internal audit) as an update to its previous three lines of defense model. Internal auditing, according to the IIA, is an independent, objective assurance and consulting activity designed to add value and improve an organization’s operations.

Traditionally, audits are performed in stages, with the audit team completing one stage before moving to the next stage. This is known as a waterfall approach: planning, fieldwork, reporting, and follow-up. But the risk landscape has drastically changed. In today’s rapidly changing environment, the approach no longer serves the organization well in many instances.

Today, most Agile Audits are performed by breaking the audit timeline into a number of sprints. The author describes several agile auditing experiments. The first experiment follows an approach were the audit team uses a Scrum-based approach with sprints of 1 month. This already brought great advantages. A next experiment uses the DevOps philosophy (flow/systems thinking, feedback loops, continual learning, and experimentation) to create one team of auditors and client staff to bring even more advantages and of course also this experiment showed that there was room for improvement. You’re not “doing” Agile (output approach), you’re being agile (outcome approach). The real benefits of auditing with agility are realized when you operate in an agile, adaptable manner. Auditing with agility focuses on three core components: value, integration, and adaptability. Auditing with agility still delivers independent, objective assurance and consulting services to add value and improve an organization’s operations. But it will be done sooner, safer, and much happier.

Auditing with agility benefits are:

• Stronger relationships between auditors and clients.
• Increased employee engagement.
• Delivery of value focused in areas of greatest risk and highest value to your organization.
• Greater buy-in (from both clients and auditors).
• Increased ability to respond to change.
• More timely communication of results (and value) to stakeholders.
• Elevated awareness of and ability to address risk.
• Reduction in time wasted.

And it gives solutions to some common problems we face during traditional or waterfall approach audits. E.g.:

• From the client’s Side:
  • Audit work is unplanned work.
  • Auditors don’t understand our business.
  • Audit reports don’t tell us anything we don’t already know.
• From the auditor’s side:
  • Context switching.
  • Managing chokepoints/dependencies on certain people.
  • Ongoing observation negotiations after agreement.

The second part of the book focusses on the three core components of auditing with agility. It explains practices and principles, and presents case studies as well as notes for clients:

• Value driven auditing (the scope of audit work must be driven by what adds the most value to your organization). 
• Integrated auditing (e.g., financial, operational, compliance, and technology)
• Adaptable auditing (improving the scope of audit work must be driven by what adds the most value to your organization).

Value driven agile practices and principles are:

• Value actionable insights over extensive documentation.
• Satisfy stakeholders through the delivery of value.
• Deliver value frequently.
• Break down the audit scope into manageable pieces.
• Measure progress through the delivery of value.
• Increase visibility.
• Constantly optimize for global goals rather than individual goals.

Integrated auditing practices and principles are:

• Practice intentional collaboration.
• Work together daily.
• Work as a single team toward a collective goal.
• Use integrated planning.
• Create feedback loops.

Adaptable auditing practices and principles are:

• Value people over processes.
• Respond to change over strictly following a plan.
• Prefer face-to-face conversation over text-based, asynchronous communication.
• Promote sustainable work.
• Pursue simplicity.
• Leverage self-organizing teams.
• Organize stand-ups.
• Limit work in process.
• Reduce batch sizes.

The third part discusses the transformation of the audit. The time to move to auditing with agility is now. Organizations can no longer apply a static audit approach to dynamic processes. Risks now change with radical velocity, and auditors need to keep up with, if not stay ahead of, the risk curve. The audit transformation is comparable with an agile transformation.

The author gives some common challenges and how to overcome them:

• Get comfortable being uncomfortable.
• Change the how, not the what.
• Complying with IIA standards.
• Workload/backlog management.
• Put processes and people before tools.
• Exile edicts and mandates.
• Drop the binary thinking.
• Making the case to audit leadership.
• Making the case to the client.

Conclusion. This book with all the cases shows that the application of the agile mindset, practices and principles resulting in auditing with agility can bring a lot of benefits to the audited organization, the auditing team, and the client. It explains in detail the three core components of auditing with agility and gives practices and principles and presents case studies as well as notes for clients. Again, an example of being agile outside IT. A must read for auditors and for those who are involved in an audit.

To order: managementboek.nl, bol.com